Prevent integer underflow in rw_t3t_act_handle_check_ndef_rsp()

Bug: 120502559
Test: NFC Enable/Disable, Read T3T Tag
Merged-In: I25389b85b14e74b0a20eb2e41373b5708ea057b1
Change-Id: I25389b85b14e74b0a20eb2e41373b5708ea057b1
(cherry picked from commit 9c1db58dc4d7174c5037650c1d7a22806a3bb070)
diff --git a/src/nfc/tags/rw_t3t.c b/src/nfc/tags/rw_t3t.c
index d65bec8..c5df1b7 100644
--- a/src/nfc/tags/rw_t3t.c
+++ b/src/nfc/tags/rw_t3t.c
@@ -1513,10 +1513,11 @@
                     p_t3t_rsp[T3T_MSG_RSP_OFFSET_RSPCODE]);
     nfc_status = NFC_STATUS_FAILED;
     GKI_freebuf(p_msg_rsp);
-  } else {
+  } else if (p_msg_rsp->len >= T3T_MSG_RSP_OFFSET_CHECK_DATA &&
+             p_t3t_rsp[T3T_MSG_RSP_OFFSET_NUMBLOCKS] > 0) {
     /* Notify app of NDEF segment received */
-    rsp_num_bytes_rx = p_t3t_rsp[T3T_MSG_RSP_OFFSET_NUMBLOCKS] *
-                       16; /* Number of bytes received, according to header */
+    /* Number of bytes received, according to header */
+    rsp_num_bytes_rx = p_t3t_rsp[T3T_MSG_RSP_OFFSET_NUMBLOCKS] * 16;
     p_cb->ndef_rx_offset += p_cb->ndef_rx_readlen;
     read_data.status = NFC_STATUS_OK;
     p_msg_rsp->offset +=
@@ -1555,6 +1556,11 @@
         }
       }
     }
+  } else {
+    android_errorWriteLog(0x534e4554, "120502559");
+    GKI_freebuf(p_msg_rsp);
+    nfc_status = NFC_STATUS_FAILED;
+    RW_TRACE_ERROR0("Underflow in p_msg_rsp->len!");
   }
 
   /* Notify app of RW_T3T_CHECK_CPLT_EVT if entire NDEF has been read, or if